6 ms·

The entire cdnjs is one dude plus some "core" maintainers with no access? Amazing.

jimws 7y ago
That's the reality of a lot of open source based services. Did you know that the entire PyPI was run and probably still is being run by just two guys?
- xtreak29 7y ago
  And infrastructure cost is 2-3 million dollars per year to have PyPI running. https://twitter.com/dstufft/status/1127320131359653890 https://twitter.com/dstufft/status/1127320131359653890
gempir 7y ago
This the normal in open source sadly. Most companies don't bother paying what they use so there are few people who can maintain such projects. I mean even the Linux Kernel was maintained like that a few years ago.
paulddraper 7y ago
Wait until you hear about OpenSSL.
- deleted 7y ago
  [deleted]
- boffinism 7y ago
  Can someone tl;dr for me?
  - cameronbrown 7y ago
    Heartbleed was a direct result of lack of resources. Billions of dollars have been shifted through OpenSSL but nobody thought to contribute back to this critical infra.
    - netsharc 7y ago
      NTP was being maintained by 1 guy in 2016: https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html https://www.infoworld.com/article/3144546/time-is-running-ou... And then some committee came along and thought everything was crap and they'd do it better. Featuring ESR: https://lwn.net/Articles/713901/ https://lwn.net/Articles/713901/ An Internet without a reliable way of figuring out the true time would be... messy.
  - Macha 7y ago
    http://veridicalsystems.com/blog/of-money-responsibility-and-pride/ http://veridicalsystems.com/blog/of-money-responsibility-and... Shortly after heartbleed it turned out openssl was funded by a couple of developers doing enhancements as contracting work and $9000/yr in donations despite being relied on by most of the internet.
  - michaelt 7y ago
    OpenSSL is a very widely used SSL library. It's used by Apache and nginx, as well as many e-mail, chat and VPN servers. Estimates include 84% of popular websites, and 96% of GitHub client keys were generated with OpenSSL [1] Heartbleed [2] was a bug in OpenSSL disclosed in 2014, which had very severe security implications. Subsequently, people noticed OpenSSL typically receives about $2,000 in donations a year and has just one employee who works full time on the open source code. [3] [1] https://crocs.fi.muni.cz/public/papers/acsac2017 https://crocs.fi.muni.cz/public/papers/acsac2017 [2] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed [3] https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...

That's the reality of a lot of open source based services. Did you know that the entire PyPI was run and probably still is being run by just two guys?

xtreak29 7y ago
And infrastructure cost is 2-3 million dollars per year to have PyPI running. https://twitter.com/dstufft/status/1127320131359653890 https://twitter.com/dstufft/status/1127320131359653890

gempir 7y ago

This the normal in open source sadly. Most companies don't bother paying what they use so there are few people who can maintain such projects. I mean even the Linux Kernel was maintained like that a few years ago.

paulddraper 7y ago

Wait until you hear about OpenSSL.

deleted 7y ago
[deleted]
boffinism 7y ago
Can someone tl;dr for me?
- cameronbrown 7y ago
  Heartbleed was a direct result of lack of resources. Billions of dollars have been shifted through OpenSSL but nobody thought to contribute back to this critical infra.
  - netsharc 7y ago
    NTP was being maintained by 1 guy in 2016: https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html https://www.infoworld.com/article/3144546/time-is-running-ou... And then some committee came along and thought everything was crap and they'd do it better. Featuring ESR: https://lwn.net/Articles/713901/ https://lwn.net/Articles/713901/ An Internet without a reliable way of figuring out the true time would be... messy.
- Macha 7y ago
  http://veridicalsystems.com/blog/of-money-responsibility-and-pride/ http://veridicalsystems.com/blog/of-money-responsibility-and... Shortly after heartbleed it turned out openssl was funded by a couple of developers doing enhancements as contracting work and $9000/yr in donations despite being relied on by most of the internet.
- michaelt 7y ago
  OpenSSL is a very widely used SSL library. It's used by Apache and nginx, as well as many e-mail, chat and VPN servers. Estimates include 84% of popular websites, and 96% of GitHub client keys were generated with OpenSSL [1] Heartbleed [2] was a bug in OpenSSL disclosed in 2014, which had very severe security implications. Subsequently, people noticed OpenSSL typically receives about $2,000 in donations a year and has just one employee who works full time on the open source code. [3] [1] https://crocs.fi.muni.cz/public/papers/acsac2017 https://crocs.fi.muni.cz/public/papers/acsac2017 [2] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed [3] https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...